Network desktop management security system and method

ABSTRACT

The present invention involves a desktop administration system and method which allows a network administrator to remotely create, protect, and manage desktops and control file systems across a network. The invention provides a graphic user interface to construct user desktops, apply restriction options, maintain transaction logs, and password protect any object accessible from the user workstation. The server software operates to lock out any unpermitted users, allowing access to programs or processes presenting appropriate keys or other authentication information. Each workstation includes a personal desktop facility (PDF) and a Daemon which protects the user&#39;s desktop. The PDF receives desktop information from the network server and builds a desktop which the user manipulates to invoke local and/or network programs and access local and/or network utilities, providing appropriate keys or other authentication information to access restricted network resources. The Daemon serves as an interface for the PDF by channeling any communication to or from the user or the network, preventing unauthorized transactions at either the workstation or network level. The PDF provides a graphic user interface using objects that encapsulate programs with data, such as user preferences, default directories, and access privileges. The Daemon performs many tasks, including starting the PDF, enumerating the windows of the graphic user interface, and recording operations.

CROSS-REFERENCE TO RELATED APPLICATIONS

The present application is a continuation-in-part of U.S. patentapplication Ser. No. 08/509,688, filed Jul. 31, 1995.

MICROFICHE APPENDIX

This application includes by reference the microfiche appendix of U.S.patent application Ser. No. 08/509,688, having 722 frames. Thisapplication also includes a microfiche appendix having 1070 frames and17 sheets. A portion of the disclosure of this patent document containsmaterial which is the subject to copyright protection. The copyrightowner has no objection to the facsimile reproduction by anyone of thepatent document or the patent disclosure, as it appears in the Patentand Trademark Office patent files or records, but otherwise reserves allcopyright rights whatsoever.

BACKGROUND OF THE INVENTION

1. Field of the Invention

The invention relates to network administration software. Morespecifically, the field of the invention is that of networkadministration software for managing user workstations on a network.

2. Description of the Related Art

Computer networks are arranged so that a multitude of users can accesscommon network resources. Each user has a workstation, typically a standalone personal computer which is connected through a suitablecommunications link to the other computers of the network. The networkadministrator is a program which runs on the network server or anadministrator workstation which coordinates and manages the access andsecurity of the users on the network. The management of users involvesallocating and facilitating access to resources such as programs anddata files which are needed or desired by particular users. The securityprovisions involve allowing only the appropriate users access to certainprograms and data files to maintain the integrity and privacy of thenetwork system.

Desktop administration programs provide each user with an individualview of the user's workstation configuration, the network, and theresources available over the network. Such programs conventionallyprovide a graphic user interface and operate under several constraints.One constraint involves the transparency of the desktop administrationprogram. Transparency in this context means the ability of a user toascertain the presence of the program merely from observing theoperation of the user's workstation. Ideally, a user should not be ableto detect the presence of the desktop administration program. Anotherconstraint involves the underlying operating system of the workstationcomputer and the network. Ideally, the desktop administration programshould not interfere with the operation of any portion of the underlyingoperating system. The management of individual user preferences alsoconstrains desktop administration programs. Ideally, the user'smodifications of a desktop configuration should not corrupt the desktopadministration program's management of user desktops. Known desktopreplacement or administration programs have difficulties in one or moreof these constraints.

What is needed is a desktop administration program which alleviates theabove identified constraints and works in concert with the operatingsystem and its standard graphic user interface.

SUMMARY OF THE INVENTION

The present invention is a desktop administration system and methodwhich allows a network administrator to remotely create, protect, andmanage desktops across a network. The invention provides a graphic userinterface to construct user desktops, apply restriction options,maintain transaction logs, and password protect any object accessiblefrom the user workstation. The invention allows these functions withoutaltering how a user works on the desktop, or the capacities of theunderlying operating system or network.

Each workstation includes a personal desktop facility (PDF) and a Daemonwhich protects the user's desktop. The personal desktop facilityreceives desktop information from the network server and builds adesktop which the user manipulates to invoke local and/or networkprograms and access local and/or network utilities. The Daemon serves asan interface for the personal desktop facility by channeling anycommunication to or from the user or the network, preventingunauthorized transactions at either the workstation or network level.

The personal desktop facility (PDF) provides a graphic user interfaceusing objects that represent collections of programs and data, such asuser preferences, default directories, and access privileges. The PDFcan create objects, remove objects, and alter object settings. Providinga user with the proper collection of objects with the proper settingscreates a workstation tailored to the users needs, thus increasing theefficiency of the user.

The daemon has many tasks, including starting the PDF, enumerating thewindows of the graphic user interface, and recording operations.Starting the PDF may involve obtaining security clearance, and includesloading the user's desktop from the server. Enumerating the windows ofthe graphic user interface facilitates proper operation of the desktopand the programs running under it. Recording operations may involvecreating a log of user operations, such as tagging or signaling eventswhen they occur, noting the usage of passwords, and the startup and exitof the desktop from the network connection.

The present invention provides several significant advantages. Thenetwork administrator may standardize desktops quickly and uniformly bymanipulating the server's database of personal desktop profiles, or bymodifying common desktop objects which are stored on the server. Usersmay also be mobile across the network, because regardless of whichmachine they use, the PDF will load their personal desktop file from thenetwork server. The Daemon further protects the desktop from inadvertentdamage, and prevents intentional alteration of the network architecture.

The present invention, in one form, relates to a computer network forproviding user access to resources including at least one of local andnetwork computer programs, local and network peripheral devices, andexternal communication devices, the network comprising a server, aplurality of workstations coupled to the server, each workstationincluding display a graphic user interface for a user, and acommunications device for transmitting messages between the server andthe workstations. The server provides access to at least one resourcefor a user who operates one of the workstations, with the serverincluding a plurality of information records each with a user specificworkstation configuration including specification of accessibleresources for the user. The workstation includes a desktop facility forcreating and displaying items referencing resources on a display meansof the workstation, the desktop facility capable of retrieving one ofthe information records from said server, said desktop means furtherincluding means for preventing a user from accessing any resources notspecified by said retrieved information record.

The present invention, in another form, is a method for a network ofcomputers including a server and a workstation. The method providesusers access to resources and comprises the steps of creating aplurality of information records each with a user specific workstationconfiguration including specification of accessible resources for theuser; retrieving one of the user specific information records using acomputer program operating on the workstation; and providing on theworkstation a desktop user interface providing user access as specifiedby the information record associated with the user.

The inventional method may also include the step of blocking access toresources via a security kernel, wherein the information records includea key for only allowing access to resources via the security kernel. Themethod may further include the step of allowing access to resources uponreceipt of a corresponding key from the desktop user interface.

Other aspects of the invention relate to the step of monitoringprocesses initiated by the desktop user interface, wherein themonitoring step includes the step of checking processes on theworkstation against the user specific information record received fromthe server. Also, the inventional method prevents unauthorized access tothe network resources through the desktop, and may impose accessrestrictions based on information stored on the workstation or requirethat a user have access to a validation resource before allowing accessto a specified resource. In another aspect of the invention, the networkuses an object oriented operating system, and each object includes aplurality of instructions and associated data so that the system createsa list of objects representing the resources. The desktop may be storedafter a session with a user, or filtered according to criteria receivedfrom the server.

Another aspect of the invention relates to a machine-readable programstorage device for storing encoded instructions for a method ofproviding user access to resources in a network of computers including aserver and a workstation according to the foregoing method.

BRIEF DESCRIPTION OF THE DRAWINGS

The above mentioned and other features and objects of this invention,and the manner of attaining them, will become more apparent and theinvention itself will be better understood by reference to the followingdescription of an embodiment of the invention taken in conjunction withthe accompanying drawings, wherein:

FIG. 1 is a schematic diagrammatic view of a computer network using thepresent invention.

FIG. 2 is a flow chart diagram of the operation of the presentinvention.

Corresponding reference characters indicate corresponding partsthroughout the several views. Although the drawings representembodiments of the present invention, the drawings are not necessarilyto scale and certain features may be exaggerated in order to betterillustrate and explain the present invention. The exemplification setout herein illustrates an embodiment of the invention, in one form, andsuch exemplifications are not to be construed as limiting the scope ofthe invention in any manner.

DESCRIPTION OF THE PRESENT INVENTION

The embodiment disclosed below is not intended to be exhaustive or limitthe invention to the precise form disclosed in the following detaileddescription. Rather, the embodiment is chosen and described so thatothers skilled in the art may utilize its teachings.

The detailed descriptions which follow are presented in part in terms ofalgorithms and symbolic representations of operations on data bitswithin a computer memory representing alphanumeric characters or otherinformation. These descriptions and representations are the means usedby those skilled in the art of data processing arts to most effectivelyconvey the substance of their work to others skilled in the art.

An algorithm is here, and generally, conceived to be a self-consistentsequence of steps leading to a desired result. These steps are thoserequiring physical manipulations of physical quantities. Usually, thoughnot necessarily, these quantities take the form of electrical ormagnetic signals capable of being stored, transferred, combined,compared, and otherwise manipulated. It proves convenient at times,principally for reasons of common usage, to refer to these signals asbits, values, symbols, characters, display data, terms, numbers, or thelike. It should be borne in mind, however, that all of these and similarterms are to be associated with the appropriate physical quantities andare merely used here as convenient labels applied to these quantities.

Some algorithms may use data structures for both inputting informationand producing the desired result. Data structures greatly facilitatedata management by data processing systems, and are not accessibleexcept through sophisticated software systems. Data structures are notthe information content of a memory, rather they represent specificelectronic structural elements which impart a physical organization onthe information stored in memory. More than mere abstraction, the datastructures are specific electrical or magnetic structural elements inmemory which simultaneously represent complex data accurately andprovide increased efficiency in computer operation.

Further, the manipulations performed are often referred to in terms,such as comparing or adding, commonly associated with mental operationsperformed by a human operator. No such capability of a human operator isnecessary, or desirable in most cases, in any of the operationsdescribed herein which form part of the present invention; theoperations are machine operations. Useful machines for performing theoperations of the present invention include general purpose digitalcomputers or other similar devices. In all cases the distinction betweenthe method operations in operating a computer and the method ofcomputation itself should be recognized. The present invention relatesto a method and apparatus for operating a computer in processingelectrical or other (e.g., mechanical, chemical) physical signals togenerate other desired physical signals.

The present invention also relates to an apparatus for performing theseoperations. This apparatus may be specifically constructed for therequired purposes or it may comprise a general purpose computer asselectively activated or reconfigured by a computer program stored inthe computer. The algorithms presented herein are not inherently relatedto any particular computer or other apparatus. In particular, variousgeneral purpose machines may be used with programs written in accordancewith the teachings herein, or it may prove more convenient to constructmore specialized apparatus to perform the required method steps. Therequired structure for a variety of these machines will appear from thedescription below.

The present invention deals with "object-oriented" software, andparticularly with an "object-oriented" operating system. The"object-oriented" software is organized into "objects", each comprisinga block of computer instructions describing various procedures("methods") to be performed in response to "messages" sent to theobject. Such operations include, for example, the manipulation ofvariables and the transmission of one or more messages to other objects.Messages are sent and received between objects having certain functionsand knowledge to carry out processes. Messages are generated in responseto user instructions, for example, by a user activating an icon with a"mouse" pointer. Also, messages may be generated by an object inresponse to the receipt of a message. When one of the objects receives amessage, the object carries out an operation (a message procedure)corresponding to the message and, if necessary, returns a result of theoperation. Each object has a region where internal states (instancevariables) of the object itself are stored and where the other objectsare not allowed to access. One feature of the object-oriented system isinheritance. For example, an object for drawing a "circle" on a displaymay inherit functions and knowledge from another object for drawing a"shape" on a display.

A programmer "programs" in an object-oriented programming language bywriting individual blocks of code each of which creates an object bydefining its methods. A collection of such objects adapted tocommunicate with one another by means of messages comprises anobject-oriented program. Object-oriented computer programmingfacilitates the modeling of interactive systems in that each componentof the system can be modeled with an object, the behavior of eachcomponent being simulated by the methods of its corresponding object,and the interactions between components being simulated by messagestransmitted between objects.

An operator may stimulate a collection of interrelated objectscomprising an object-oriented program by sending a message to one of theobjects. The receipt of the message may cause the object to respond bycarrying out predetermined functions which may include sendingadditional messages to one or more other objects. The other objects mayin turn carry out additional functions in response to the messages theyreceive, including sending still more messages. In this manner,sequences of message and response may continue indefinitely or may cometo an end when all messages have been responded to and no new messagesare being sent. When modeling systems utilizing an object-orientedlanguage, a programmer need only think in terms of how each component ofa modeled system responds to a stimulus and not in terms of the sequenceof operations to be performed in response to some stimulus. Suchsequence of operations naturally flows out of the interactions betweenthe objects in response to the stimulus and need not be preordained bythe programmer.

Although object-oriented programming makes simulation of systems ofinterrelated components more intuitive, the operation of anobject-oriented program is often difficult to understand because thesequence of operations carried out by an object-oriented program isusually not immediately apparent from a software listing as in the casefor sequentially organized programs. Nor is it easy to determine how anobject-oriented program works through observation of the readilyapparent manifestations of its operation. Most of the operations carriedout by a computer in response to a program are "invisible" to anobserver since only a relatively few steps in a program typicallyproduce an observable computer output.

In the following description, several terms which are used frequentlyhave specialized meanings in the present context. The term "object"relates to a set of computer instructions and associated data which canbe activated directly or indirectly by the user. The terms "windowingenvironment", "running in windows", and "object oriented operatingsystem" are used to denote a computer user interface in whichinformation is manipulated and displayed on a video display such aswithin bounded regions on a raster scanned video display. The terms"network", "local area network", "LAN", "wide area network", or "WAN"mean two or more computers which are connected in such a manner thatmessages may be transmitted between the computers. In such computernetworks, typically one or more computers operate as a "server", acomputer with large storage devices such as hard disk drives andcommunication hardware to operate peripheral devices such as printers ormodems. Other computers, termed "workstations", provide a user interfaceso that users of computer networks can access the network resources,such as shared data files, common peripheral devices, andinter-workstation communication. Users activate computer programs ornetwork resources to create "processes" which include both the generaloperation of the computer program along with specific operatingcharacteristics determined by input variables and its environment.

The terms "desktop", "personal desktop facility", and "PDF" mean aspecific user interface which presents a menu or display of objects withassociated settings for the user associated with the desktop, personaldesktop facility, or PDF. The term "Daemon" refers to a program which isnot necessarily apparent to the user, but which is responsible fortransmitting messages between the PDF and the network server and forprotecting and regulating the user's ability to use and modify networkresources. Although the following description details such operations interms of a graphic user interface using icons, the present invention maybe practiced with text based interfaces, or even with voice or visuallyactivated interfaces.

A computer network is shown in block diagram form in FIG. 1, showing thegeneral orientation and arrangement of the software operating on thecomputer equipment, including the server administration, the workstationPDF, and the Daemon software. Network 20 includes at least one server 22and at least one, and typically dozens or hundreds, of workstations 24.Server 22 and workstations 24 are connected by communication line 26which may be an ethernet cable or another suitable device. Network 20also includes several shared peripheral devices, such as disk storage 28(typically coupled directly to server 22, although connection throughcommunication line 26 is also possible), printers 30, modems 32, androuter 34. ADMIN (administration) software 36 resides on server 22, andgenerally controls communications between the components of network 20.For example, ADMIN software 34 typically controls access to disk storage28, the scheduling of printing jobs on printers 30, the allocation ofmodems 32, and the transmission of information through router 34.

Each workstation 24 includes a computer with a monitor and keyboard,such as a standard personal computer (e.g., an IBM-PC type or Macintosh)or an advanced computer (e.g., a Next or SPARC workstation), and mayinclude its own peripheral devices such as local printer 38, local modem40, or local disk storage 42. With the present invention, eachworkstation 24 includes PDF 44 and Daemon 46. PDF 44 provides a graphicuser interface, or "desktop", to the programs and resources available onits workstation 24 and generally through network 20. Daemon 46 serves asan intermediary between ADMIN 36 and PDF 44, filtering out unauthorizedactivities and maintaining the integrity of the desktop. ADMIN 36 onlyaccepts requests and receives messages from Daemon 46, so PDF 44 isrequired to access information and programs through Daemon 46, and mustsend all of its information to ADMIN 36 through Daemon 46. Further, PDF44 may only change the parameters of the desktop through Daemon 46, andDaemon 46 determines what operations are permissible based on criteriasupplied from ADMIN 36. Daemon 46 includes both an initiation routine(contained in the source code file KP2WPS.C of the parent application)and a periodic checking routine (contained in the source code fileKP2SHUF.C of the parent application) to implement these functions. Withthis arrangement, which is explained in further detail below and in thesource code appendix, the integrity of each desktop is maintained byDaemon 46, and permanently maintained by ADMIN 36.

In accordance with the present invention, disk 28 of server 22 stores.sec file 50 (the logical designation of .sec file 50 may includeseveral separate physical files which are interrelated through logicalconnections). ADMIN software 36 uses the information contained in .secfile 50 to specify the menu of computer programs and network resourceswhich may be referenced by the desktops of the users of network 20. .secfile 50 may be a general file for all the users of network 20.Alternatively, .sec file 50 may represent a collection of files, whicheach file corresponding to a particular user or a particular class ofuser. Another alternative is a hybrid approach, wherein the menuinformation has a common component and a user specific component. In anyevent, this arrangement allows for a network administrator to directlymanipulate .sec file 50 with ADMIN software 36 on server 22 to modify,customize, and/or maintain the desktops across a network, rather thanhaving to change each desktop configuration locally.

In addition to ADMIN 36 creating .sec file 50 to record a user's desktopconfiguration on server 22, the present invention uses PDF 44 to enforcethe user's desktop configuration directly on workstation 24. PDF 44operates on the assumption that unless the user is specificallyauthorized to access a particular computer program or resource, thatuser's workstation should not be allowed to manipulate or interact withthat particular item. Only upon receiving .sec file 50 from ADMIN 36does PDF 44 construct a desktop for the user, and that desktop onlyprovides access to computer programs and resources which arespecifically identified for the user on .sec file 50. Thus, with thefirst embodiment of the present invention (disclosed in the source codeappendix of parent patent application Ser. No. 08/509,688), accesscontrol is first maintained at the level of workstations 24 to enhancethe protection of server 22.

In a second embodiment of the invention (disclosed in the source codeappendix of the present invention), ADMIN 36 on server 22 locks out theuser from the file system software at workstation 24, and only aproperly configured desktop provided by PDF 44 can present a key tounlock the file system and access resources on server 22. Theimplementation of the second embodiment with the OS/2 operating systemincludes several routines of ADMIN 36 which interact with certainsecurity features of the OS/2 operating system to achieve this file lockout. However, one of ordinary skill in this art would readily appreciatethat such server access control lock-outs may be implemented with anyoperating system by a suitably designed program operating with thebenefit of system administration privileges.

The present invention may be best explained using the paradigm of anobject oriented operating system. However, one of ordinary skill in theoperating system programming art recognizes that all operating systemsmay be abstracted to conform with object oriented programming principlesso that a programmer may impose object oriented programming principleson any operating system. The exemplary embodiment of the presentinvention works in conjunction with the OS/2* operating system developedand sold by International Business Machines, Incorporated (IBM) (*"OS/2"is a trademark of IBM). The OS/2 operating system formally identifiesand utilizes objects as part of its operating schema, wherein theindividual processes managed by the OS/2 operating system areencapsulated by objects which define the computer programs, data, icons,access privileges, and other attributes effecting the ability of theprocess to influence or alter other portions of the system. Many similaroperating systems use an object oriented operating schema, and thus thepresent invention is directly applicable to many conventional operatingsystems, including Windows95 and WindowsNT made by MicrosoftCorporation.

In an object oriented operating system, programs and the processes theycreate may be associated with a class which has common characteristics.The class designation communicates to the operating system that theclass member includes a predefined set of characteristics. Accessprivileges and security clearances may be set for classes rather thanhaving to identify such information for every individual object orprocess. Also, PDF 44 and ADMIN 36 may be designed to include securityand control algorithms which can target classes of processes rather thanonly singly identified processes. The following example of a .sec fileused in the second embodiment of the invention as a default desktopprofile, implemented in this embodiment as a flat text file, providesseveral class designations along with the other desktop information.

    __________________________________________________________________________    [Master] ENABLESECURITY=OBJECTS;RESTRICTUNDEF=YES;DESC=Default                Workstation                                                                   Desktop;PASSWORD=.ae butted.SeuoJoEycEo.left brkt-top.asi.left brkt-top.u.    tangle-solidup.GU§▾Σ≅⋄;LOG=BCD    [Folder] TITLE=Desktop; CLASS=DskDesktop; OBJECTID=<WP.sub.-- DESKTOP>;       ICONRESOURCE=56,PMWP.DLL; DEFAULTVIEW=OPEN.sub.-- DEFAULT;                    POPUP=6258802;                                                                HELPPANEL=4000; MINWIN=VIEWER; NOCOPY=YES; NODELETE=YES; NOPRINT=YES;         BYPSSETUP=YES; WINLIST=YES; INCCHLD=YES; BACKGROUND=                          C:\OS2\BITMAP\BUBBLPAD.BMP, T, 0, I, 163        163 148; ICONFONT=8.Helv;                                                     ICONVIEW=NOGRID,NORMAL; TREEFONT=8.Helv; TREEVIEW=MINI,LINES;                 DETAILSFONT=8.Helv;                                                           [Folder] TITLE=OS/2 System; CLASS=PRDirectory; OBJECTID=<DO.sub.--            OS2SYS>;                                                                      PARENTID=<WP.sub.-- DESKTOP> ;SHADOWID=<WP.sub.-- OS2SYS>; ICONPOS=8,         80;                                                                           DEFAULTVIEW=184, 345, 716, 291; HELPPANEL=4002; MINWIN=VIEWER;                NOCOPY=YES;                                                                   NODELETE=YES; NODRAG=YES; NODROP=YES; NOMOVE=YES; NORENAME=YES;               NOLINK=YES; NOSETTINGS=YES; NOPRINT=YES; WINLIST=YES;                         BACKGROUND=(none),,,C,255 255 236; ICONFONT=8.Helv; ICONVIEW=FLOWED,MINI;     TREEFONT=8.Helv; TREEVIEW=MINI,LINES; DETAILSFONT=8.Helv;                     [Folder]TITLE=Connections; CLASS=PRDirectory;                                 OBJECTID=<DO.sub.-- CONNECTIONSFOLDER>; PARENTID=<WP.sub.-- DESKTOP>;         SHADOWID=<WP.sub.-- CONNECTIONSFOLDER>; ICONPOS=8,62;                         DEFAULTVIEW=OPEN.sub.-- DEFAULT; HELPPANEL=1277; MINWIN=VIEWER;               NOPRINT=YES;                                                                  WINLIST=YES; BACKGROUND=(none), , , C, 255 255 236; ICONFONT=8.Helv;          ICONVIEW=NOGRID, NORMAL; TREEFONT=8.Helv; TREEVIEW=MINI,LINES;                DETAILSFONT=8.Helv;                                                           [Folder] TITLE=Assistance Center; CLASS=PRDirectory; OBJECTID=<DO.sub.--      ASSISTANCE>;                                                                  PARENTID=<WP.sub.-- DESKTOP>; SHADOWID=<WP.sub.-- ASSISTANCE>;                ICONPOS=8,71;                                                                 DEFAULTVIEW=OPEN.sub.-- DEFAULT; HELPPANEL=1277; MINWIN=VIEWER;               NOPRTNT=YES;                                                                  WINLIST=YES; BACKGROUND=(none),,,C,255 255 236; ICONFONT=8.Helv;              ICONVIEW=FLOWED,MINI; TREEFONT=8.Helv; TREEVIEW=MINI,LINES;                   DETAILSFONT=8.Helv;                                                           [Folder] TITLE=Programs; CLASS=PRDirectory; OBJECTID=<DO.sub.-- PROGRAMSFO    LDER>;                                                                        PARENTID=<WP.sub.-- DESKTOP>; SHADOWID=<WP.sub.-- PROGRAMSFOLDER>;            ICONPOS=8,53;                                                                 DEFAULTVIEW=OPEN.sub.-- DEFAULT; HELPPANEL=1277; MINWIN=VIEWER;               NOPRINT=YES;                                                                  WINLIST=YES; BACKGROUND=(none),,,C,255 255 236; ICONFONT=8.Arial;             ICONVIEW=FLOWED,MINI; TREEFONT=8.Arial; TREEVIEW=MINI,LINES;                  DETAILSFONT=8.Arial;                                                          [Folder] TITLE=WebExplorer; CLASS=PRDirectory; OBJECTID=<DO.sub.--            WC.sub.-- WEBEX.sub.-- FOLD0>;                                                PARENTID=<WP.sub.-- DESKTOP>; SHADOWID=<WC.sub.-- WEBEX.sub.-- FOLD>;         ICONPOS=8,44;                                                                 DEFAULTVIEW=OPEN.sub.-- DEFAULT; HELPPANEL=1277; MINWIN=VIEWER;               NOPRINT=YES;                                                                  WINLIST=YES; BACKGROUND=(none),,,C,255 255 236; ICONFONT=9.WarpSans;          ICONVIEW=NOGRID,NORMAL; TREEFONT=9.WarpSans; TREEVIEW=MINI,LINES;             DETAILSFONT=9.WarpSans;                                                       [Object] TITLE=Shredder; CLASS=WPShredder; OBJECTID=<DO.sub.-- SHRED>;        PARENTID=<WP.sub.-- DESKTOP>; SHADOWID=<WP.sub.-- SHRED>; ICONPOS=88,32;      ICONRESOURCE=28,PMWP.DLL; DEFAULTVIEW=OPEN.sub.-- DEFAULT;                    HELPPANEL=1190;                                                               MINWIN=VIEWER; NOCOPY=YES; NODELETE=YES; NOPRINT=YES; WINLIST=YES;            [Object] TITLE=Templates; CLASS=DskShadow;                                    OBJECTID=<DO.sub.-- Templates0DskShadowDskDesktop>; PARENTID=<WP.sub.--       DESKTOP>;                                                                     SHADOWID=<WP.sub.-- TEMPS>; ICONPOS=8,34; DEFAULTVIEW=OPEN.sub.--             DEFAULT;                                                                      HELPPANEL=15680; MINWIN=VIEWER; NOPRINT=YES; WINLIST=YES;                     [Object] TITLE=Black Hole; CLASS=BlackHole; OBJECTID=<DO.sub.-- BLACKHOLE0    >;                                                                            PARENTID=<WP.sub.-- DESKTOP>; SHADOWID=<BLACKHOLE>; ICONPOS=80,32;            ICONRESOURCE=22,PMWP.DLL; DEFAULTVIEW=OPEN.sub.-- DEFAULT;                    MINWIN=VIEWER;                                                                NOPRINT=YES; WINLIST=YES;                                                     [Pad] TITLE=LaunchPad; CLASS=WPLaunchPad; OBJECTID=<DO.sub.-- LAUNCHPAD>;     PARENTID=<WP.sub.-- DESKTOP>; ICONPOS=79,87; ICONRESOURCE=74,PMWP.DLL;        DEFAULTVIEW=OPEN.sub.-- DEFAULT; HELPPANEL=32253; CCVIEW=NO;                  MINWIN=VIEWER;                                                                NOPRINT=YES; WINLIST=YES; FPOBJECTS=<WPPO.sub.-- IBMLASER>, <WP.sub.--        DRIVE.sub.-- A>,                                                              <WP.sub.-- OS2WIN>, <WP.sub.-- ASSISTANCE>, <WP.sub.-- SHRED>;                LPACTIONSTYLE=TEXT;                                                           LPHIDECTLS=YES;                                                               DRAWEROBJECTS=3,<WP.sub.-- WIN2WIN>,<WP.sub.-- DOSWIN> ;2,<WP.sub.--          DRIVES>;                                                                      [Program] TITLE=Verify r nDefects; CLASS=WPProgram;                           OBJECTID=<DO.sub.-- Verify.sub.-- Defects0WPProgramDskDesktop>;               PARENTID=<WP.sub.-- DESKTOP>;                                                 SHADOWID=<DU.sub.-- Verify.sub.-- Defects0WPProgramDskDesktop>;               ICONPOS=88,67;                                                                DEFAULTVIEW=OPEN.sub.-- DEFAULT; HELPPANEL=4083; CCVIEW=NO;                   MINWIN=VIEWER;                                                                NOPRINT=YES; USEPARENT=YES; WINLIST=YES; EXENAME=D:\TOOLS.backsl    ash.VERDFCT.CMD;                                                              PROGTYPE=WINDOWABLEVIO;                                                       [Program] TITLE=SkyScraper; CLASS=WPProgram;                                  OBJECTID=<DO.sub.-- SkyScraper0WPProgramDskDesktop>; PARENTID=<WP.sub.--      DESKTOP>;                                                                     SHADOWID=<DU.sub.-- SkyScraper0WPProgramDskDesktop>; ICONPOS=9,90;            DEFAULTVIEW=OPEN.sub.-- DEFAULT; HELPPANEL=4083; CCVIEW=NO;                   MINWIN=DESKTOP;                                                               NOPRINT=YES; LNCHPROG=C:\OS2\E.EXE;                       EXITPROG=C:\OS2\ICONEDIT.EXE;                             EVENTEXIT=YES; EVENTLNCH=YES; GLBLPW=YES;                                     EXENAME=C:\SKY\SKY.EXE;PARAMETERS=/ao /r1 /d2 /j1 /g2     /ml /x2;                                                                      STARTUPDIR=C:\SKY;PROGTYPE=PM;                                      [Program] TITLE=Rejected r nDefects;                                          CLASS=WPProgram;OBJECTID=<DO.sub.-- Rejected.sub.-- Defects0WPProgramDskDe    sktop>;                                                                       PARENTID=<WP.sub.-- DESKTOP>; SHADOWID=<DU.sub.-- Rejected.sub.--             Defects0WPProgramDskDesktop>;                                                 ICONPOS=89,45; DEFAULTVIEW=OPEN.sub.-- DEFAULT; HELPPANEL=4083;               MINWIN=VIEWER; NOPRINT=YES; WINLIST=YES; EXENAME=D:\TOOLS.backsl    ash.REJECT.CMD;                                                               PROGTYPE=WINDOWABLEVIO;                                                       [Datafile] TITLE=config.sys; CLASS=WPDataFile; OBJECTID=<DO.sub.--            C.sub.-- config.sub.-- sys0>;                                                 PARENTID=<WP.sub.-- DESKTOP>; SHADOWID=C:\config.sys;               DEFAULTVIEW=OPEN.sub.-- DEFAULT; NVBLDORIG=YES; VPF=C:\DSKOBV;      HELPPANEL=4082; CVIEW=YES; HIDEBUTTON=YES; MINWIN=DESKTOP;                    WINLIST=YES; LOG=ABCD;                                                        [Object] TITLE=Drive D;CLASS=PRDisk; OBJECTID=<DO.sub.-- DRIVE.sub.--         D>;                                                                           PARENTID=<WP.sub.-- DESKTOP>; SHADOWID=<WP.sub.-- DRIVE.sub.-- D>;            ICONRESOURCE=13,PMWP.DLL; DEFAULTVIEW=120; HELPPANEL=8015;                    MINWIN=VIEWER; NOCOPY=YES; NODELETE=YES; NOMOVE=YES; NOPRINT=YES;             WINLIST=YES;                                                                  [Printer] TITLE=IBM Laser - Optra E; CLASS=WPRPrinter;                        OBJECTID=<DO.sub.-- WPPO.sub.-- IBMLASER0>; PARENTID=<WP DESKTOP>             ;SHADOWID=<WPPO.sub.-- IBMLASER>; DEFAULTVIEW=OPEN.sub.-- CONTENTS;           HELPPANEL=15409; CCVIEW=NO; MINWIN=VIEWER ;NOPRINT=YES; WINLIST=YES;          NETID=LS:\\*COLORADO\LASER ;ALIAS=IBMLASER;     SHOWJOBS=ALL;REFRESH=25;                                                      [Program] TITLE=Sample Program; CLASS=WPProgram; OBJECTID=<DO.sub.--          SAMPLEPROG>;                                                                  PARENTID=<WP.sub.-- DESKTOP>; DEFAULTVIEW=OPEN.sub.-- DEFAULT;                CCVIEW=YES;                                                                   HIDEBUTTON=YES; MINWIN=HIDE; NOTVISIBLE=YES; NOMOVE=YES;                      NORENAME=YES; NOSETTINGS=YES; TEMPLATE=YES; WINLIST=YES;                      EXENAME=C:\OS2\ATTRIB.EXE; PARAMETERS=+r [Enter file      to write-protect];                                                            PROGTYPE=PM;                                                                  [Ses] TRUSTEDAPP=c:\os2\e.exe;RUNWARN=1;LOG=AD;           [Ses] FILE=autoexec.bat;DIR=c:;LOCK=FILE;RUNWARN=0;FILEATTR=RWDM;LOG=aceg;    [Ses] DIR=c:\os2; LOCK=DIR; SUBDIR=YES; RUNWARN=0;                  FILEATTR=WDM;                                                                 DIRATTR=CGDM; LOG=cegkmo;                                                     [Ses] FILE=protocol.ini; DIR=c:\ibmlan; UNLOCK=FILE; OCCUR=ALL;     RUNWARN=0;                                                                    FILEATTR=RWDM;                                                                [Device] PORTS=COM1,COM2,COM3,COM4,LPT1; LOG=ABCD;                            [Filter] TEXT=WarpCenter; BEGMTCH=YES; NOCLSWPS=YES;                          [FiIter] TEXT=System; PASSWORD=.ae butted.=eo o .left brkt-top.yiEcoSas.GA    MMA.<io&"▾Σ≡⋄;             MIDMTCH=YES; WINLIST=YES; IGNCASE=YES; LOG=ABCD;                              [End]                                                                         __________________________________________________________________________

Each initial bracketed item identifies the class of the object,including desktop objects, devices, filters, or file system objects,which is utilized by PDF 44 to invoke the appropriate program, installthe appropriate desktop icon, or initialize the appropriate resource.The first item, [Master], is a header block identifying the .sec file,in this instance a Master file for a default workstation desktop. Thestatement ENABLESECURITY=OBJECTS instructs PDF 44 to use securityprivileges on an object level ("FS" would instruct PDF 44 to use filesystem security privileges, while "BOTH" would enable both object andfile system security), while the statement RESTRICTUNDEF=YES instructsPDF 44 to check for, and if an undefined process is found, restrict itsaccess to workstation 24 and server 22. The PASSWORD statementidentifies the default security password, which is encrypted, and thestatement LOG=BCD activates a transaction log in the background of thedesktop operation. These and other high level instructions can thus beprovided to PDF 44 on the workstation from the .sec file provided byADMIN 36. ADMIN 36 can then block all access to network resources by theworkstation until supplied the appropriate information (e.g., keys,predefined requests, or passwords) from PDF 44.

The second item of the .sec file of the example, [Folder] TITLE=Desktop,is the highest level class and identifies the desktop user interfacerepresentation of the object. The statement CLASS=DskDesktop indicatesthat the object belongs to the class of top level desktop display whichis created by inheriting characteristics from the WPShell class and addsfurther characteristics utilized by the inventional method (theDskDesktop class is sometimes referred to as a replacement class as itreplaces the WPShell class). This desktop class of object represents PDF44 to the user, and the statements within this item of the .sec fileprovide the default parameters for the user interface to PDF 44.However, PDF 44 does not include security and privilege informationrelating to workstation process, such information being stored on alocal .sec file which is referred to by PDF 44.

The third item of the .sec file of the example, [Folder] TITLE=OS/2System, identifies the desktop user interface representation of theobject, and the statement CLASS=PRDirectory indicates that the objectbelongs to a class of program directories. Such a PRDirectory may be asubclass of a folder class, such as created by a LAN network system.This object represents a directory of programs to the user, specificallyin this case a collection of OS/2 operating system programs. Any programactivated from a particular folder inherits the privileges of the folderunless the program object itself overrides the inherent privileges. Thisitem includes three identifications used by PDF 44 in manipulating thisor related objects, namely OBJECTID (the identifier of the objectitself), PARENTID (the identifier of the parent of the object), andSHADOWID (the pointer to the original object). The item also includesseveral display parameters, and several security/privilege indicators.This "OS/2 System" item includes several identifiers and indicatorswhich are used in [Folder] class items. Icons are located inside thefolders, and processes started by invoking the icons will have defaultaccess privileges according to the security/privilege statements of theoriginating folder, and all parent folders (folders which contain otherfolders).

The items identified by [Pad], [Program], [Datafile], and [Printer] alldeal with discreet logical and/or physical devices. The [Pad] itemrefers to a facility which can initiate other operations orapplications, or "launch" them, e.g., represented by a "LaunchPad" icon.The [Program] item refers to an executable file which when launchedcreates a process on workstation 24 and/or server 22, and may includeAPI initialization strings and other related data. The [Datafile] itemrefers to a data file which when launched will activate an associatedapplication program executable file. The [Printer] item (or other"Device" item) refers to a peripheral computer device such as a printer,modem, joystick, or similar input and/or output device.

The [Ses] item specifically relates to executables, directories, and/ordevices of PDF 44 and Daemon 46 which interact with the SecurityEnabling Services kernel features of the OS/2 operating system.Alternatively, such an item could relate to separate parts of ADMIN 36and/or Daemon 46 which initially lock and can later unlock the filesystem. ADMIN 36, PDF 44, and Daemon 46 are programmed to recognizespecially designated objects as "trusted applications" and allow suchtrusted applications access to certain system level files. Asimplemented by the present invention, ADMIN 36, PDF 44, and Daemon 46also allow "Device" items to be locked and/or monitored to maintain alog file of all operations occurring on or through the device.

The [Filter] item can be used by PDF 44 when creating or operating adesktop, or by Daemon 46 during an enumeration routine. The filteringprocess may be implemented on a class level, or alternatively objecttitles may be subject to such filtering. For example, a filter item maybe used to remove window list entries from a desktop without a userprompt or acknowledgment. Another use of a filter may be to keep certainprocesses running during the creation or re-creation of a desktop (forexample, to keep an external communication link active even though thelocal desktop is being rebuilt). A filter may also be used to require apassword from PDF 44 or the user before invoking certain objects orclasses of objects.

For objects which do not fall within one of the foregoing classes, theitem designation [Object] provides a format for a user defined object,such as an abstract non-file system object. These types of abstractobjects are of the .dll type, which are not necessarily with executablefiles rather are substantiated by the shell (often referred to as workplace shell applications). Statements within this object shall beinterpreted as if the statement occurred in one of the previouslydefined classes.

The present invention also provides two additional ways to secure thedesktop, one being a hardware based restriction and the other a contextbased validation. The hardware based restriction is maintained by anadditional file (RESTRICT.TXT) resident on the local computer which PDF44 checks before creating desktop objects. In this manner,localcomputers can be configured so that certain sensitive applicationscannot be created or invoked at certain physical locations, regardlessof the privilege level of the user. The context based validation is astatement in a .sec file item, VPF=<path>.linevert split.<filename>,which requires that the path or file specified be present and/oraccessible by the user on the network before PDF 44 creates thespecified desktop object.

PDF 44 thus creates a desktop which includes a graphic display of iconsrepresenting programs, files, network resources, and other relatedinformation. When the user launches a program or network resource andthereby creates a new process, PDF 44 displays a new window on themonitor of workstation 24 showing the activity of the new process. Inthe exemplary embodiment with a multi-tasking operating system, morethan one process can appear on the desktop simultaneously. PDF 44presents the most current window in the forefront, with the otherwindows accessible through a command. Also in the exemplary embodimentwith an object oriented operating system, the communication andimplementation of processes are achieved through the use of objectswhich contain the needed information for executing the process andinteracting with other portions of the system. Each icon on the desktophas an associated object so that when PDF 44 observes the operatoractivating a particular icon, the corresponding object may be launchedand a new display window may be created.

Before PDF 44 can operate, however, the objects which PDF 44 displaysmust be created. The user may first required to log in to network 20before accessing workstation 24. Daemon 46 obtains the user's desktopprofile from ADMIN 36, the desktop profile being a list of objects withappropriate restrictions and privileges, which may include keys or otherauthentication information. In addition, ADMIN 36 may also imposed otherrestrictions on that desktop profile transmitted to Daemon 46 based onthe physical location or node of the user logging on to network 20. Thatdesktop profile includes general information about the restrictions andboundaries applicable to PDF 44, as well as the objects available to PDF44. Daemon 46 also obtains local attribute information, such as thepresence or absence of local peripheral devices from workstation 24. PDF44 may then transmit requests for creation of processes to Daemon 46,which determines if the requested process is permitted according toADMIN 36's desktop profile for that user. This arrangement allows a userto log in at any workstation 24 of network 20 and have the same desktopdisplayed by PDF 44.

In the second embodiment of the invention, ADMIN 36 operates to lock outany user from accessing network resources. By enabling file system levelblocking, no program or process can access a network file except throughthe enabled security procedure which requires a previously establishedaccess privilege to have existed for the user. The .sec file 50 maycontain the information needed to "unlock" the security procedure andallow a user access to the network resource. In this way, any userattempt to access a network resource without using PDF 44 will fail.Only by using PDF 44, which is enabled by an appropriate key or otherauthentication information in the user's .sec file 50, can a user accessnetwork resources.

The general sequence of operation is shown in the flow chart diagram ofFIG. 2. Workstation 24 is powered on in step 200, which may include theuse of appropriate access control software. Daemon 46 obtains theparameters associated with that particular workstation 24, typically byaccessing a locally stored file or performing a diagnostic routine, instep 202. For example, in the exemplary embodiment, Daemon 46 firstkills any old objects which are apparent on workstation 24. After thisinitial cleansing, Daemon 46 loads a binary file stored on local disk 42which contains a set of all the possible objects for workstation 24,then hides those objects from display by PDF 44. Next Daemon 46 loads asecond binary file of the active objects for workstation 24. Typically,this set of active objects includes a self-launching network log onprocedure, typically involving typing in a username and password at step204.

In accordance with the present invention, Daemon 46 may then obtain auser network profile from ADMIN Software 36 in step 206. In the secondembodiment of the invention, ADMIN 36 initially blocks the user bydenying all access privileges to network resources. Once Daemon 46 hasthe information regarding the local workstation and the user's networkprofile, typically by accessing .sec file 50 on server 22, PDF 44 mayset up the user's desktop in step 208 by creating a list of objectsrepresenting the possible available resources, both on network 22 andworkstation 24. In the second embodiment, PDF 44 may also obtainsuitable access enabling information from .sec file 50 to allow the userto access security protected resources, such as a security key or othersuitable authentication. At this point, workstation 24 is able toreceive input from the user to initiate or interact with processes andaccomplish the desired computing functions.

Daemon 46 continues to monitor the operations of workstation 24 so thatthe user does not modify the desktop created by PDF 44 in circumventionof the user's access and security provisions. In step 210, a timer isset so that Daemon 46 is activated periodically. In the exemplaryembodiment of the invention, an interval of approximately three (3)seconds has been selected as a suitable period for activating Daemon 46with the hardware and software being used with the inventional system.This interval is selected to check sufficiently frequently to catchviolations before significant damage has occurred, without significantlyreducing the efficiency and responsiveness of workstation 24. Also, thisinterval is adjustable by simply changing initialization parameters,without requiring reconfiguration of any other part of the system.However, one of ordinary skill understands that the periodic intervalused to call Daemon 46 is dependent upon the hardware and softwarespeed.

While the timer is running, step 212 allows the user to activate andmanipulate workstation 24 as desired. During this period of operation,step 214 involves determining whether a termination condition hasoccurred, e.g., a user activated exit or a fatal system error, so thatworkstation 24 may be shut down. Should a termination condition beobserved, step 222 (described in greater detail below) would then occur.In the typical case, however, processing would continue until timerinterrupt step 216 occurs. The timer interrupt causes Daemon 46 tobecome the active program of the system, which allows Daemon 46 to checkon the status of the other processes at workstation 24.

In the run Daemon 218 step, an enumeration process is conducted by theprocessor of workstation 24. Daemon 46 checks every process that ispresent in workstation 24 against the process information contained inits local copy of .sec file 50. Every process which is not found in thelisting of .sec file 50 is processed further by Daemon 46, typicallydeleting and removing the unknown process from workstation 24. However,other operations are possible, and sometimes desired. For example, amessage box may be displayed and the process may be modified accordingto the user's response to correspond to a known process. Anotheralternative may be to record the presence of the unknown process in alog for use by diagnostic software.

Known processes encountered by Daemon 46 during the enumeration routinemay be dealt with in several ways. Typically, Daemon 46 checks forconsistency between the process as noted by the desktop files by PDF 44and the information from .sec file 50, making corrections whenappropriate. Also, Daemon 46 checks the security protection of theprocess and the user for compliance with network security privileges. Ifan inconsistency is discovered, or a security violation, or anothersimilar condition, then Daemon 46 may respond by: requesting a passwordfrom the user before allowing further access or processing; delete andremove the process from the desktop; record the presence of the processon a log file; rebuild the process using the original process and a userresponse to a message box; and/or another suitable response to theobserved inconsistency. When Daemon 46 completes all of its operationson the processes of workstation 24, the timer is reset at step 210 andthe foregoing steps are repeated.

Finally, when the user is ready to terminate operation of workstation24, PDF 44 requests that the potentially modified desktop be saved instep 222. Daemon 46 receives this request, first filtering the newerdesktop with the original user profile to make sure that the new desktopdoes not violate any of the user's profile information stored on server22. After the new desktop has been so filtered, Daemon 46 saves thefiltered new desktop by storing the representative file or files onserver 22. Now, the operation of workstation 24 can be properlyterminated at step 224.

The microfiche appendix contains an implementation of the presentinvention. The source code files in the appendix are associated withvarious directories. Following is a table showing the directories andthe related source code description:

    ______________________________________                                        Directory Description                                                         ______________________________________                                        dskwps    This directory contains the source code of the engine                         which builds the desktop and creates the daemon.                    dskcvl    This directory contains the source code of the object                         oriented data storage, low level code which loads                             information in the .sec files into an object                                  representation.                                                     dskcmd    This directory contains the source code to the                                command line interface to the daemon.                               dskdesk   This directory contains the source code for creating                          a "superclass" which inherits attributes of desktop                           items.                                                              dskwpobj  This directory contains the source code for creating                          a "superclass" which inherits attributes of shell                             objects.                                                            dskapi    This directory contains the source code for creating                          a third party vendor version of the present invention                         for use in conjuction with other software.                          dsksift   This directory contains the source code for the                               shuffle or sifter routines of the daemon and its logic.             dskfs     This directory contains the source code for the file                          system daemon.                                                      dsktimer  This directory contains the source code for an                                autologout routine which times out inactive users.                  pdfadmin  This directory contains the source code for a test                            driver to use in conjuction with the dskapi routines.               dskses    This directory contains the source code for the                               hooks into the file system which allows for the file                          system lockout.                                                     ______________________________________                                    

While this invention has been described as having an exemplary design,the present invention may be further modified within the spirit andscope of this disclosure. This application is therefore intended tocover any variations, uses, or adaptations of the invention using itsgeneral principles. Further, this application is intended to cover suchdepartures from the present disclosure as come within known or customarypractice in the art to which this invention pertains.

What is claimed is:
 1. A computer network for providing user access toresources including one of local and network computer programs, localand network peripheral devices, and external communication devices, saidnetwork comprising:a server; a plurality of workstations coupled to saidserver, each said workstation including display means for providing agraphic user interface for a user; and communication means fortransmitting messages between said server and said plurality ofworkstations; said server including means for providing access to atleast one resource for a user, said user operating one of saidworkstations, said network including a plurality of information recordseach with a user specific workstation configuration includingspecification of accessible resources for the user, said plurality ofinformation records being located on at least one of said server andsaid plurality of workstations; one of said workstations includingdesktop means for creating and displaying items referencing resources onsaid display means of said one workstation, said desktop means includingmeans for retrieving one of said information records upon activation ofsaid one workstation, said desktop means further including means forpreventing a user from accessing any resources not specified by saidretrieved information record, said retrieving means adapted to locate afirst one of said information records on said one workstation toactivate said preventing means to limit user access according to saidfirst information record from said one workstation prior to said oneworkstation establishing contact with said network, and said retrievingmeans adapted to receive a second information record from said server tolimit user access according to said second information record from saidserver.
 2. The system of claim 1 wherein said server includes a securitykernel for blocking user access to resources and only allowing useraccess to resources upon receipt of a corresponding key, saidinformation records including one of said keys for allowing user accessto resources via said security kernel, and said desktop means includingmeans for unlocking user access to said resources by transmitting one ofsaid keys to said security kernel.
 3. The system of claim 1 wherein saiddesktop means includes means for initiating processes on saidworkstation and daemon means for monitoring processes initiated by saiddesktop means.
 4. The system of claim 3 wherein said daemon meansincludes enumeration means for checking processes on the workstationagainst the information record.
 5. The system of claim 1 wherein saiddesktop means includes hardware restriction means for imposing accessrestrictions based on information stored on one of said workstations. 6.The system of claim 1 wherein said desktop means includes validationmeans for requiring that a user have access to a validation resourcebefore allowing access to a specified resource.
 7. The system of claim 1with an object oriented operating system, each object including aplurality of instructions and associated data, wherein said desktopmeans includes means for creating a list of objects representing theresources.
 8. The system of claim 1 wherein said desktop means creates amenu of resources and includes means for storing said menu after asession with a user.
 9. The system of claim 8 wherein said desktop meansincludes filtering means for filtering menu items according to criteriareceived from the server.
 10. In a network of computers including aserver and a workstation, a method of providing user access toresources, said method comprising the steps of:creating a plurality ofinformation records with a user specific workstation configurationincluding specification of accessible resources for the user; retrievingone of the user specific information records using a computer programoperating on the workstation; and providing on the workstation a desktopuser interface providing user access as specified by the informationrecord associated with the user and providing on the workstation adesktop security computer program that prevents a user from accessingany resources not specified by the information record associated withthe user, and including a control program with the desktop userinterface which locates a first one of said information records on theworkstation to activate the desktop security computer program to limituser access according to the first information record from theworkstation prior to the workstation establishing contact with thenetwork, and the control program adapted to receive a second informationrecord from the server to limit user access according to the secondinformation record from the server.
 11. The method of claim 10 furthercomprising the step of blocking user access to resources via a securitykernel, wherein said information records include a key for only allowinguser access to resources via said security kernel, and furthercomprising the step of allowing user access to resources upon receipt ofa corresponding key from said desktop user interface.
 12. The method ofclaim 10 further comprising the step of monitoring processes initiatedby the desktop user interface.
 13. The method of claim 12 wherein saidmonitoring step includes the step of checking processes on theworkstation against the user specific information record received fromthe server.
 14. The method of claim 10 further comprising the step ofpreventing unauthorized access to the network resources through saiddesktop.
 15. The method of claim 10 further comprising the step ofimposing access restrictions based on information stored on theworkstation.
 16. The method of claim 10 further comprising the step ofrequiring that a user have access to a validation resource beforeallowing access to a specified resource.
 17. The method of claim 10 withthe network using an object oriented operating system, each objectincluding a plurality of instructions and associated data, furthercomprising the step of creating a list of objects representing theresources.
 18. The method of claim 10 further including the step ofstoring said desktop after a session with a user.
 19. The method ofclaim 10 wherein said providing step includes the step of filtering saiddesktop according to criteria received from the server.
 20. Amachine-readable program storage device for storing encoded instructionsfor a method of providing user access to resources in a network ofcomputers including a server and a workstation, said method comprisingthe steps of:creating a plurality of information records each with auser specific workstation configuration including specification ofaccessible resources for the user; retrieving one of the user specificinformation records using a computer program operating on theworkstation; and providing on the workstation a desktop user interfaceproviding user access as specified by the information record associatedwith the user and providing on the workstation a desktop securitycomputer program that prevents a user from accessing any resources notspecified by the information record associated with the user, andincluding a control program with the desktop user interface whichlocates a first one of said information records on the workstation toactivate the desktop security computer program to limit user accessaccording to the first information record from the workstation prior tothe workstation establishing contact with the network, and the controlprogram adapted to receive a second information record from the serverto limit user access according to the second information record from theserver.
 21. The machine-readable program storage device of claim 20further comprising encoded instructions for the step of blocking useraccess to resources via a security kernel, wherein said informationrecords include a key for only allowing user access to resources viasaid security kernel, and further comprising encoded instructions forthe step of allowing user access to resources upon receipt of acorresponding key from said desktop user interface.
 22. Themachine-readable program storage device of claim 20 further comprisingencoded instructions for the step of monitoring processes initiated bythe desktop user interface.
 23. The machine-readable program storagedevice of claim 22 further comprising encoded instructions for the stepof checking processes on the workstation against information receivedfrom the server.
 24. The machine-readable program storage device ofclaim 20 further comprising encoded instructions for the step ofimposing access restrictions based on information stored on theworkstation.
 25. The machine-readable program storage device of claim 20further comprising encoded instructions for the step of requiring that auser have access to a validation resource before allowing access to aspecified resource.
 26. The machine-readable program storage device ofclaim 20 further comprising encoded instructions for the step ofascertaining the configuration of the workstation.
 27. Themachine-readable program storage device of claim 20 with the networkusing an object oriented operating system, each object including aplurality of instructions and associated data, further comprisingencoded instructions for the step of creating a list of objectsrepresenting the network resources.
 28. The machine-readable programstorage device of claim 20 further comprising encoded instructions forthe step of storing said desktop after a session with a user.
 29. Themachine-readable program storage device of claim 20 further includingencoded instructions for the step of filtering said desktop according tocriteria received from the server.
 30. In computer network for providinguser access to resources including one of local and network computerprograms, local and network peripheral devices, and externalcommunication devices, with the network including a server, a pluralityof workstations coupled through a massaging system to each other and theserver, the workstations including displays for providing a graphic userinterface for users, the network having a plurality of profileinformation records each with a user specific workstation configurationincluding specification of accessible resources for the user, theprofile information records being located on at least one of the serverand the workstations, a computer program for one of the workstations,said computer program including:desktop means for creating anddisplaying items referencing resources on a display of a workstation;profile means for receiving a profile information record; and securitymeans for preventing a user from accessing any resources not specifiedby said retrieved profile information record, and said desktop means forlocating a first one of said profile information records on the oneworkstation to activate said security means to limit user accessaccording to said first profile information record from the workstationprior to the workstation establishing contact with the network, and saiddesktop means adapted to receive a second profile information recordfrom the server to limit user access according to said second profileinformation record from the server.
 31. The system of claim 30 whereinthe server includes a security kernel for blocking user access toresources and only allowing user access to resources upon receipt of acorresponding key, the profile information records including one of thekeys for allowing user access to resources via the security kernel, andsaid desktop means including means for unlocking user access to theresources by transmitting one of the keys to the security kernel. 32.The system of claim 30 wherein said desktop means includes means forinitiating processes on said workstation and daemon means for monitoringprocesses initiated by said desktop means.
 33. The system of claim 32wherein said daemon means includes enumeration means for checkingprocesses on the workstation against the profile information record. 34.The system of claim 30 wherein said desktop means includes hardwarerestriction means for imposing access restrictions based on informationstored on one of the workstations.
 35. The system of claim 30 whereinsaid desktop means includes validation means for requiring that a userhave access to a validation resource before allowing access to aspecified resource.
 36. The system of claim 30 with an object orientedoperating system, each object including a plurality of instructions andassociated data, wherein said desktop means includes means for creatinga list of objects representing the resources.
 37. The system of claim 30wherein said desktop means creates a menu of resources and includesmeans for storing said menu after a session with a user.
 38. The systemof claim 37 wherein said desktop means includes filtering means forfiltering menu items according to criteria from the profile informationrecord.